vBulletin Forums and User Accounts being exploited

[GoTTi]

vbulletin staff please send out a security bulletin regarding this issue.

What is happening:
A user is posting a thread or reply with a image that on mouseover, records the users cookie onto a .php file page, which is printing out the data to a .txt file. The data being recorded is the cookie information of the user mousing over the image. When the user does the mouseover on the image, the image will disappear, when that happens, the cookie information is recorded to the external site.

This makes it easy for someone to login as another user, including admins. all the exploiter has to do is edit their cookie file, save it, and visit the site and they are logged in as the user. Admins need to be careful....

This has happened to only 2 forums i know of right now, including mine.

After reading the code in the thread that the user posted, its being done using HTML. now, we are always told to disable HTML on our forums, but LOTS of people use it because its a handy tool for users on our forums to play with.

so i guess the only fix, besides disabling the HTML on your forums, is to censor out these keywords that are needed for the recording of the cookie data:

onMouseover="document.sam.src=
+document.cookie;">

i believe censoring out these keywords will work and help protect our forums


Note: im not sure if "document.sam.src=" is needed to be censored. i think just censoring onMouseover is good enough...